When 28.8 Million Queries Become a Weapon: A Technical Anatomy of the Distillation Offense and Defense

On June 24, 2026, Anthropic wrote to the U.S. Senate Banking Committee and White House officials accusing Alibaba-linked operators of mounting a large-scale distillation campaign against Claude using roughly 25,000 accounts. Over 45 days there were more than 28.8 million interactions, specifically targeting high-value capabilities in software engineering and agentic reasoning. This allegation follows Anthropic's earlier accusations this year against three other Chinese LLM firms. The claim awaits responses from involved parties, but it has already sparked deeper debate.

More dramatically, an open-source model that appeared on Hugging Face a week earlier, Qwable-v1, provided a publicly inspectable technical specimen for this controversy. Released by an independent developer and built on the Qwen-series MoE architecture, the model used chained distillation to inject Claude-like reasoning chains and agentic tool-use capabilities. It completed training with about 4,600 SFT examples, a single H200 GPU and roughly 14 hours of training. It transparently demonstrated the efficiency limits of distillation techniques.

How Distillation Works

Knowledge distillation, first popularized by Geoffrey Hinton in 2015, transfers knowledge from a larger "teacher" model to a smaller "student" model so the student retains high performance while reducing compute and deployment costs.

The basic process includes:

The teacher generates high-quality outputs (including reasoning chains and probability distributions).
The student imitates via supervised fine-tuning (SFT) or reinforcement learning.
Advanced variants include chain-of-thought distillation (used by Qwable-v1), adversarial distillation, and others.

In the LLM domain, distillation is particularly effective at compressing trillion-parameter models into efficient versions. Qwable-v1 is a typical example: it migrated Claude's advanced reasoning and tool-use behaviors onto an open-source Qwen base, enabling rapid capability replication driven by the community.

The Technical Logic of a Distillation Attack

A distillation attack differs from traditional data theft. Its goal is not to obtain model weights but to systematically collect a teacher model's reasoning processes and tool-use patterns for specific tasks via large-scale, structured API calls, then train an in-house model on those outputs. Attackers do not need to understand Claude's internals — they only need to make Claude "perform" enough times.

This campaign showed a high degree of organization. The roughly 25,000 accounts followed a focused query strategy centered on code generation, debugging, and multi-step tool invocation scenarios. This task-focused distillation maximizes the information density of each training example. Given that Claude can produce thousands of tokens of reasoning chains